Labs / ethical hacking

Reconnaissance: Passive OSINT and Active Host Discovery

beginner Any PC with internet access + an isolated lab network (EVE-NG/VM) you own or are authorized to test reconnaissanceosintnetwork-security

Scenario

Before touching any system directly, practice building a target profile the way a real engagement starts. Authorization note: only run active steps (Step 3 onward) against systems you own or a lab network you control — never against a domain or host you don’t have explicit permission to test.

What you need

  • A domain name you own, or a well-known public domain that publishes intentionally open WHOIS/DNS data for learning (many registrars provide sandbox/test domains for this purpose).
  • An isolated lab network with 2–3 VMs for the active portion (e.g. an EVE-NG topology with two or three Linux VMs).

Step 1 — Passive: WHOIS lookup

$ whois example.com

Record the registrar, creation date, and any listed contact information. Note whether WHOIS privacy protection is enabled — this tells you something about the organisation’s operational security awareness.

Step 2 — Passive: DNS record enumeration

$ dig A example.com
$ dig MX example.com
$ dig NS example.com
$ dig TXT example.com

Record what each reveals: the A record (IP address), MX (mail servers, useful context for phishing-simulation assessments), NS (authoritative name servers), and TXT (sometimes reveals SPF records or verification tokens for third-party services in use).

Step 3 — Active: host discovery on your lab network

On your own isolated lab network (not the domain from Steps 1–2):

$ nmap -sn 192.168.100.0/24

This is a ping sweep — it identifies which lab hosts are actually live, without scanning any ports yet.

Step 4 — Compile a target profile

Write a short summary combining everything: passive findings (organisation footprint) and active findings (confirmed live hosts on your lab network). This is exactly the output recon is meant to produce — a profile that feeds directly into the scanning phase.

Break it

Try the same dig queries against a domain with WHOIS privacy enabled and compare how much less information is available — this is a practical illustration of why privacy protection is itself a defensive control.

Reference

  • AddySec original content — written for the Ethical Hacking track, building on Passive Reconnaissance and Active Reconnaissance.